SOAR101 question regarding passing variables

NuttyBrown — Fri, 11 Apr 2025 18:43:59 GMT

Just getting started with SOAR and I am encountering a scenario where I obviously don't understand the concept enough. I could use a push in the right direction to understand how I'm supposed to pass output from a Splunk action block to a decision or utility block. Logic is as follows:

1. We utilize a Splunk -- Timer asset to schedule execution of playbook at certain time

2. First block is a Splunk query action block; basic SPL is

index=custom_index usernames=* | table usernames, emailAddresses, userScore

3. I want to pass the usernames to a decision block, and this is where I get lost. I see event choices, and CEF fields, etc. as options, but nothing explicitly stated for "usernames". Am I supposed to custom code a solution using action_result.data, and if so, can I get a hint on how to do so? (this wasn't covered in my creating playbooks course)

Thank you

Re: SOAR101 question regarding passing variables

livehybrid — Sat, 12 Apr 2025 14:01:18 GMT

To pass the usernames field from your Splunk action block to a decision or utility block in SOAR, use the custom output paths from the action result.

In the decision block, reference the field as action_result.data.*.usernames.

The Splunk action block returns results as a list of dictionaries under action_result.data.

The .*. wildcard iterates over each result, accessing the usernames field from each row.

Field names are case-sensitive and must match exactly as returned by your SPL.

If your SPL returns multiple rows, the path will return a list of values.

The following docs pages may also be useful:

https://docs.splunk.com/Documentation/SOAR/current/Playbook/SpecifyData

https://docs.splunk.com/Documentation/SOAR/current/DevelopApps/DataPath

https://docs.splunk.com/Documentation/Phantom/4.10.7/PlaybookAPI/Datapaths

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

topic SOAR101 question regarding passing variables in Splunk SOAR

SOAR101 question regarding passing variables

Re: SOAR101 question regarding passing variables